Privacy policy

We never ask you for anything

There is not a single input field on this website. No contact form, no sign-up, no newsletter, no basket and no payment. We therefore collect no name, phone number, email address or payment details from this site at all.

If you contact us on LINE, by phone or by email, we keep what you send us in order to discuss your enquiry, as you would expect. Conversations on LINE are additionally governed by LINE's own privacy policy.

Data your visit creates on its own

When you open a page, technical data your browser sends automatically is recorded: the page opened, the time, the site that referred you, browser and operating system, approximate screen size, the country you connect from, and your IP address.

This data is a by-product of how the internet works rather than something we set out to gather about you individually, and we do not use it to work out who you are.

Cookies and what is stored on your device

Necessary storage — we keep one value on your device called bx_consent, which records whether you accepted or declined analytics cookies. Without it we would have to ask you again on every page. It stays on your device and is never sent to us.

Analytics cookies (consent required) — Google Analytics runs only if you press Accept. Google's script is not loaded at all until you do. If you press Decline, no analytics cookie is ever set, and you can change your mind at any time through the Cookie settings link at the bottom of every page.

Cookieless statistics — Cloudflare Web Analytics counts page views without setting a cookie, without writing anything to your device and without creating a user identifier, so it cannot follow you across websites. It runs without a consent prompt because it neither accesses nor stores information on your device.

What we use it for

To see which pages people read, which articles are useful, and where the site is failing. We use it to improve the content and the speed of the website, and for nothing else.

We do not use it to target advertising at you, we do not build individual user profiles, and we have never sold or traded visitor data.

Our lawful basis

For Google Analytics cookies we rely on your consent under section 19 of Thailand's Personal Data Protection Act B.E. 2562 (2019), which you may withdraw at any time.

For the technical data needed to serve and secure the website, and for aggregate statistics that do not identify anyone, we rely on legitimate interest under section 24(5), having judged that it does not unreasonably affect your rights.

Who receives the data

Cloudflare, Inc. — carries every request to this site as our network provider, and so necessarily sees technical data including IP addresses. It also provides the cookieless statistics described above.

Google LLC — provides Google Analytics, and only for visitors who have accepted cookies.

Beyond these two, we pass visitor data to no other third party, except where the law requires disclosure.

Transfers outside Thailand

Cloudflare and Google are both foreign companies processing data on servers outside Thailand, so using them involves a cross-border transfer under section 28. Both maintain internationally recognised data protection measures and publish their own privacy policies on their websites.

How long it is kept

Google Analytics data is retained for the period configured in Google's settings and is deleted automatically when that period expires.

Cloudflare's statistics are daily aggregate counts and are not kept at the level of an individual visitor.

The bx_consent value stays on your device until you clear your browser data.

Your rights

Under the Personal Data Protection Act B.E. 2562 (2019) you have the right to access and obtain a copy of your data, to have it corrected, to have it erased or destroyed, to restrict its use, to object to processing, to data portability, and to withdraw consent you have given.

Withdrawing consent for analytics cookies is immediate and in your own hands: use the Cookie settings link at the bottom of any page and choose Decline.

For any other right, contact us using the details below. We will respond within 30 days, and if you believe we have handled your data improperly you may complain to Thailand's Personal Data Protection Committee.

Security

Every page is served over an encrypted HTTPS connection, and plain http requests are upgraded automatically. The staff area used to manage content is separate from the public site and always requires a login.

Contact us about your data

For questions about this policy, or to exercise any of the rights above, email [email protected] or use one of the channels listed on our contact page.

Changes to this policy

If we make a material change we will update the date at the top of this page. We suggest re-reading it from time to time.